@solvapay/mcp 0.1.0 → 0.2.0

package/dist/express/index.js

@@ -0,0 +1,481 @@
+// src/express/oauth-bridge.ts
+import {
+  buildAuthInfoFromBearer,
+  getOAuthAuthorizationServerResponse,
+  getOAuthProtectedResourceResponse,
+  McpBearerAuthError,
+  resolveOAuthPaths,
+  withoutTrailingSlash
+} from "@solvapay/mcp-core";
+var NATIVE_CLIENT_ORIGIN_SCHEMES = ["cursor:", "vscode:", "vscode-webview:", "claude:"];
+function getRequestAuthHeader(req) {
+  const header = req.headers?.authorization;
+  if (typeof header === "string") return header;
+  if (Array.isArray(header)) return header[0] || null;
+  return null;
+}
+function getHeader(req, name) {
+  const header = req.headers?.[name.toLowerCase()];
+  if (typeof header === "string") return header;
+  if (Array.isArray(header)) return header[0] || null;
+  return null;
+}
+function getRequestJsonRpcId(body) {
+  if (body && typeof body === "object" && "id" in body) {
+    const id = body.id;
+    return id ?? null;
+  }
+  return null;
+}
+function makeUnauthorizedJsonRpc(id) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    error: {
+      code: -32001,
+      message: "Unauthorized"
+    }
+  };
+}
+function setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath) {
+  res.setHeader(
+    "WWW-Authenticate",
+    `Bearer resource_metadata="${withoutTrailingSlash(publicBaseUrl)}${protectedResourcePath}"`
+  );
+}
+function getRequestQuery(req) {
+  const raw = req.url ?? req.path ?? "";
+  const qIndex = raw.indexOf("?");
+  return qIndex === -1 ? "" : raw.slice(qIndex);
+}
+function isNativeClientOrigin(origin) {
+  try {
+    const url = new URL(origin);
+    return NATIVE_CLIENT_ORIGIN_SCHEMES.includes(
+      url.protocol
+    );
+  } catch {
+    return false;
+  }
+}
+function applyCorsHeaders(req, res) {
+  const origin = getHeader(req, "origin");
+  if (!origin) return;
+  if (isNativeClientOrigin(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  }
+}
+function handlePreflight(req, res) {
+  applyCorsHeaders(req, res);
+  const requestedMethod = getHeader(req, "access-control-request-method") ?? "POST";
+  const requestedHeaders = getHeader(req, "access-control-request-headers") ?? "authorization, content-type";
+  res.setHeader("Access-Control-Allow-Methods", `${requestedMethod}, OPTIONS`);
+  res.setHeader("Access-Control-Allow-Headers", requestedHeaders);
+  res.setHeader("Access-Control-Max-Age", "600");
+  res.status(204);
+  if (typeof res.end === "function") {
+    res.end();
+  } else {
+    res.json({});
+  }
+}
+async function readJsonFromResponse(upstream) {
+  const text = await upstream.text();
+  if (!text) return { body: {}, text: "" };
+  try {
+    return { body: JSON.parse(text), text };
+  } catch {
+    return { body: text, text };
+  }
+}
+async function relayJsonResponse(upstream, res) {
+  const { body, text } = await readJsonFromResponse(upstream);
+  res.status(upstream.status);
+  const contentType = upstream.headers.get("content-type");
+  if (contentType) res.setHeader("Content-Type", contentType);
+  if (text === "" && upstream.status === 204) {
+    if (typeof res.end === "function") {
+      res.end();
+      return;
+    }
+  }
+  res.json(body);
+}
+function hasOAuthErrorShape(body) {
+  return body !== null && typeof body === "object" && typeof body.error === "string";
+}
+function extractZodErrors(body) {
+  const errs = body.errors;
+  if (!Array.isArray(errs)) return [];
+  return errs.filter((e) => !!e && typeof e === "object");
+}
+function deriveOAuthErrorCode(status, nestBody) {
+  if (status === 401 || status === 403) return "invalid_client";
+  if (status >= 500) return "server_error";
+  const zodErrors = extractZodErrors(nestBody);
+  const touches = (field) => zodErrors.some((e) => {
+    const path = e.path;
+    return Array.isArray(path) && path.includes(field);
+  });
+  if (touches("grant_type")) {
+    const grantTypeErr = zodErrors.find((e) => {
+      const path = e.path;
+      return Array.isArray(path) && path.includes("grant_type");
+    });
+    const received = grantTypeErr && grantTypeErr.received;
+    if (received !== "undefined" && received !== void 0 && received !== "") {
+      return "unsupported_grant_type";
+    }
+    return "invalid_request";
+  }
+  if (touches("code") || touches("refresh_token")) return "invalid_grant";
+  if (touches("scope")) return "invalid_scope";
+  if (touches("client_id") || touches("client_secret")) return "invalid_client";
+  return "invalid_request";
+}
+function buildErrorDescription(nestBody) {
+  const zodErrors = extractZodErrors(nestBody);
+  if (zodErrors.length > 0) {
+    const parts = zodErrors.map((e) => {
+      const path = e.path;
+      const message2 = e.message;
+      const pathStr = Array.isArray(path) ? path.filter((p) => typeof p === "string").join(".") : "";
+      const msgStr = typeof message2 === "string" ? message2 : "";
+      if (pathStr && msgStr) return `${pathStr}: ${msgStr}`;
+      return pathStr || msgStr;
+    }).filter(Boolean);
+    if (parts.length > 0) return parts.join("; ");
+  }
+  const message = nestBody.message;
+  if (typeof message === "string") return message;
+  if (Array.isArray(message)) {
+    const strings = message.filter((m) => typeof m === "string");
+    if (strings.length > 0) return strings.join("; ");
+  }
+  return void 0;
+}
+function toOAuthErrorBody(body, text, status) {
+  if (hasOAuthErrorShape(body)) return body;
+  if (body && typeof body === "object") {
+    const nestBody = body;
+    const error = deriveOAuthErrorCode(status, nestBody);
+    const error_description = buildErrorDescription(nestBody);
+    return error_description ? { error, error_description } : { error };
+  }
+  const fallbackError = status >= 500 ? "server_error" : "invalid_request";
+  const description = typeof text === "string" && text.length > 0 && text.length < 500 ? text : void 0;
+  return description ? { error: fallbackError, error_description: description } : { error: fallbackError };
+}
+async function relayOAuthJsonResponse(upstream, res) {
+  if (upstream.ok || upstream.status === 204) {
+    await relayJsonResponse(upstream, res);
+    return;
+  }
+  const { body, text } = await readJsonFromResponse(upstream);
+  const normalized = toOAuthErrorBody(body, text, upstream.status);
+  res.status(upstream.status);
+  res.setHeader("Content-Type", "application/json");
+  res.json(normalized);
+}
+function sendUpstreamError(res, _error) {
+  res.status(502);
+  res.setHeader("Content-Type", "application/json");
+  res.json({ error: "upstream_unreachable" });
+}
+function serializeRegisterBody(body) {
+  if (typeof body === "string") return body;
+  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
+  return JSON.stringify(body ?? {});
+}
+function serializeFormBody(body) {
+  if (typeof body === "string") return body;
+  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
+  if (body && typeof body === "object") {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(body)) {
+      if (value === void 0 || value === null) continue;
+      if (Array.isArray(value)) {
+        for (const entry of value) params.append(key, String(entry));
+      } else {
+        params.append(key, String(value));
+      }
+    }
+    return params.toString();
+  }
+  return "";
+}
+function serializeRequestBody(contentType, body) {
+  if (contentType && contentType.includes("application/x-www-form-urlencoded")) {
+    return serializeFormBody(body);
+  }
+  if (typeof body === "string") return body;
+  if (body instanceof Uint8Array) return Buffer.from(body).toString("utf8");
+  return JSON.stringify(body ?? {});
+}
+function createOAuthRegisterHandler(options) {
+  const path = options.path ?? "/oauth/register";
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/register?product_ref=${encodeURIComponent(options.productRef)}`;
+  return async (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "POST") {
+      next();
+      return;
+    }
+    try {
+      const response = await fetch(upstream, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: serializeRegisterBody(req.body)
+      });
+      applyCorsHeaders(req, res);
+      await relayJsonResponse(response, res);
+    } catch (error) {
+      applyCorsHeaders(req, res);
+      sendUpstreamError(res, error);
+    }
+  };
+}
+function createOAuthAuthorizeHandler(options) {
+  const path = options.path ?? "/oauth/authorize";
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  return (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "GET") {
+      next();
+      return;
+    }
+    const query = getRequestQuery(req);
+    const location = `${api}/v1/customer/auth/authorize${query}`;
+    res.setHeader("Location", location);
+    res.status(302);
+    if (typeof res.end === "function") {
+      res.end();
+      return;
+    }
+    res.json({});
+  };
+}
+function createOAuthTokenHandler(options) {
+  const path = options.path ?? "/oauth/token";
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/token`;
+  return async (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "POST") {
+      next();
+      return;
+    }
+    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
+    const authorization = getHeader(req, "authorization");
+    const headers = { "content-type": contentType };
+    if (authorization) headers["authorization"] = authorization;
+    try {
+      const response = await fetch(upstream, {
+        method: "POST",
+        headers,
+        body: serializeRequestBody(contentType, req.body)
+      });
+      applyCorsHeaders(req, res);
+      await relayOAuthJsonResponse(response, res);
+    } catch (error) {
+      applyCorsHeaders(req, res);
+      sendUpstreamError(res, error);
+    }
+  };
+}
+function createOAuthRevokeHandler(options) {
+  const path = options.path ?? "/oauth/revoke";
+  const api = withoutTrailingSlash(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/revoke`;
+  return async (req, res, next) => {
+    if (req.path !== path) {
+      next();
+      return;
+    }
+    if (req.method === "OPTIONS") {
+      handlePreflight(req, res);
+      return;
+    }
+    if (req.method !== "POST") {
+      next();
+      return;
+    }
+    const contentType = getHeader(req, "content-type") ?? "application/x-www-form-urlencoded";
+    const authorization = getHeader(req, "authorization");
+    const headers = { "content-type": contentType };
+    if (authorization) headers["authorization"] = authorization;
+    try {
+      const response = await fetch(upstream, {
+        method: "POST",
+        headers,
+        body: serializeRequestBody(contentType, req.body)
+      });
+      applyCorsHeaders(req, res);
+      await relayOAuthJsonResponse(response, res);
+    } catch (error) {
+      applyCorsHeaders(req, res);
+      sendUpstreamError(res, error);
+    }
+  };
+}
+function createMcpOAuthBridge(options) {
+  const {
+    publicBaseUrl,
+    apiBaseUrl,
+    productRef,
+    mcpPath = "/mcp",
+    requireAuth = true,
+    authInfo,
+    protectedResourcePath = "/.well-known/oauth-protected-resource",
+    authorizationServerPath = "/.well-known/oauth-authorization-server",
+    oauthPaths
+  } = options;
+  const paths = resolveOAuthPaths(oauthPaths);
+  const openidDiscoveryMiddleware = (req, res, next) => {
+    if (req.method !== "GET" || req.path !== "/.well-known/openid-configuration") {
+      next();
+      return;
+    }
+    applyCorsHeaders(req, res);
+    res.status(404);
+    if (typeof res.end === "function") {
+      res.end();
+    } else {
+      res.json({ error: "not_found" });
+    }
+  };
+  const protectedResourceMiddleware = (req, res, next) => {
+    if (req.method !== "GET" || req.path !== protectedResourcePath) {
+      next();
+      return;
+    }
+    res.json(getOAuthProtectedResourceResponse(publicBaseUrl));
+  };
+  const authorizationServerMiddleware = (req, res, next) => {
+    if (req.method !== "GET" || req.path !== authorizationServerPath) {
+      next();
+      return;
+    }
+    if (!productRef) {
+      res.status(500).json({ error: "SOLVAPAY_PRODUCT_REF missing" });
+      return;
+    }
+    res.json(
+      getOAuthAuthorizationServerResponse({
+        publicBaseUrl,
+        paths
+      })
+    );
+  };
+  const registerMiddleware = createOAuthRegisterHandler({
+    apiBaseUrl,
+    productRef,
+    path: paths.register
+  });
+  const authorizeMiddleware = createOAuthAuthorizeHandler({
+    apiBaseUrl,
+    path: paths.authorize
+  });
+  const tokenMiddleware = createOAuthTokenHandler({ apiBaseUrl, path: paths.token });
+  const revokeMiddleware = createOAuthRevokeHandler({ apiBaseUrl, path: paths.revoke });
+  const mcpAuthMiddleware = (req, res, next) => {
+    if (req.path !== mcpPath) {
+      next();
+      return;
+    }
+    if (req.method && req.method !== "POST" && req.method !== "OPTIONS") {
+      applyCorsHeaders(req, res);
+      res.setHeader("Allow", "POST, OPTIONS");
+      res.status(405);
+      if (typeof res.end === "function") {
+        res.end();
+      } else {
+        res.json({ error: "method_not_allowed" });
+      }
+      return;
+    }
+    const authHeader = getRequestAuthHeader(req);
+    const id = getRequestJsonRpcId(req.body);
+    if (!authHeader && !requireAuth) {
+      next();
+      return;
+    }
+    try {
+      const auth = buildAuthInfoFromBearer(authHeader, authInfo);
+      if (!auth) {
+        throw new McpBearerAuthError("Missing bearer token");
+      }
+      req.auth = auth;
+      next();
+    } catch {
+      applyCorsHeaders(req, res);
+      res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate");
+      setMcpChallengeHeader(res, publicBaseUrl, protectedResourcePath);
+      if (req.method === "POST") {
+        res.status(401).json(makeUnauthorizedJsonRpc(id));
+        return;
+      }
+      res.status(401).json({ error: "Unauthorized" });
+    }
+  };
+  return [
+    openidDiscoveryMiddleware,
+    protectedResourceMiddleware,
+    authorizationServerMiddleware,
+    registerMiddleware,
+    authorizeMiddleware,
+    tokenMiddleware,
+    revokeMiddleware,
+    mcpAuthMiddleware
+  ];
+}
+
+// src/express/index.ts
+import {
+  getOAuthAuthorizationServerResponse as getOAuthAuthorizationServerResponse2,
+  getOAuthProtectedResourceResponse as getOAuthProtectedResourceResponse2,
+  buildAuthInfoFromBearer as buildAuthInfoFromBearer2,
+  McpBearerAuthError as McpBearerAuthError2,
+  decodeJwtPayload,
+  extractBearerToken,
+  getCustomerRefFromBearerAuthHeader,
+  getCustomerRefFromJwtPayload
+} from "@solvapay/mcp-core";
+export {
+  McpBearerAuthError2 as McpBearerAuthError,
+  buildAuthInfoFromBearer2 as buildAuthInfoFromBearer,
+  createMcpOAuthBridge,
+  createOAuthAuthorizeHandler,
+  createOAuthRegisterHandler,
+  createOAuthRevokeHandler,
+  createOAuthTokenHandler,
+  decodeJwtPayload,
+  extractBearerToken,
+  getCustomerRefFromBearerAuthHeader,
+  getCustomerRefFromJwtPayload,
+  getOAuthAuthorizationServerResponse2 as getOAuthAuthorizationServerResponse,
+  getOAuthProtectedResourceResponse2 as getOAuthProtectedResourceResponse
+};